{"id":"CVE-2026-108895","published":"2026-10-12T15:17:07.227","lastModified":"2026-10-13T16:17:12.933","description":"A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.","cvssScore":9.9,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","cwes":["CWE-77","CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys3/vuln_69/69.md","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-108895","tags":[]},{"url":"https://vuldb.com/submit/973114","tags":[]},{"url":"https://vuldb.com/vuln/416687","tags":[]},{"url":"https://vuldb.com/vuln/416687/cti","tags":[]},{"url":"https://www.linksys.com/","tags":[]}],"exploitRefs":[{"url":"https://github.com/wudipjq/my_vuln/blob/main/Linksys3/vuln_69/69.md","tags":[]}],"hasPoc":true,"ai":{"summary":"A command injection vulnerability exists in Linksys E1700 routers that allows remote attackers to execute arbitrary OS commands with administrative privileges. This flaw is particularly dangerous because it can be exploited without authentication and can lead to complete system compromise.","exploitability":"The exploit is highly practical with no authentication required, allowing attackers to execute arbitrary commands remotely with high privileges, though it requires knowledge of the specific endpoint and parameter manipulation.","blast_radius":"If exploited, this vulnerability could allow attackers to gain full administrative control over thousands of Linksys E1700 routers, potentially enabling large-scale network infiltration and persistent access to affected networks.","remediation":"Upgrade to firmware version 1.0.0.4.004 or later, which contains the patched setDMZ function in /goform/setDMZ to prevent MAC_addr parameter injection.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rce","router","command-injection","remote"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:45:48.840Z"}}